static-nginx.sh

#!/bin/bash

### build nginx as a static binary with most recent libraries.
### depends on sha256sum, tar and curl.

NGINX_VERSION="${NGINX_VERSION:-1.7.6}"
NGINX_SHA256="${NGINX_SHA256:-08e2efc169c9f9d511ce53ea16f17d8478ab9b0f7a653f212c03c61c52101599}"

NGINX_OPENRESTY_VERSION="${NGINX_OPENRESTY_VERSION:-1.7.7.1}"
NGINX_OPENRESTY_SHA256="${NGINX_OPENRESTY_SHA256:-e00b038945ca198eca7424026ccade0f8a5ad95b8aa40c5c2961684fc50ca4d4}"

OPENSSL_VERSION="${OPENSSL_VERSION:-1.0.2}"
OPENSSL_SHA256="${OPENSSL_SHA256:-8c48baf3babe0d505d16cfc0cf272589c66d3624264098213db0fb00034728e9}"

PCRE_VERSION="${PCRE_VERSION:-8.36}"
PCRE_SHA256="${PCRE_SHA256:-b37544f33caed0cc502a1e729c3b1d3df5086dcc819b9125c30700c239246c9e}"

ZLIB_VERSION="${ZLIB_VERSION:-1.2.8}"
ZLIB_SHA256="${ZLIB_SHA256:-36658cb768a54c1d4dec43c3116c27ed893e88b02ecfcb44f2166f9c0b7f2a0d}"

PAGESPEED_VERSION="${PAGESPEED_VERSION:-1.9.32.1}"
PAGESPEED_SHA256="${PAGESPEED_SHA256:-ecfac41808ba14af3574d3ed6e3f0fbb47da8e4a9b3786b056fc6caec19f1839}"

MOD_PAGESPEED_VERSION="${MOD_PAGESPEED_VERSION:-${PAGESPEED_VERSION}-beta}"
MOD_PAGESPEED_SHA256="${MOD_PAGESPEED_SHA256:-5c3706f09a88ef4b41f8592b992160bba975a3d097389cc2023b06e8e39d4024}"

if [ "${TRACE}" = "true" ]; then
    set -x
fi

set -e -u -o pipefail

NGINX_PATH="nginx-${NGINX_VERSION}"
NGINX_OPENRESTY_PATH="ngx_openresty-${NGINX_OPENRESTY_VERSION}"
ZLIB_PATH="zlib-${ZLIB_VERSION}"
OPENSSL_PATH="openssl-${OPENSSL_VERSION}"
PCRE_PATH="pcre-${PCRE_VERSION}"
PAGESPEED_PATH="psol"
MOD_PAGESPEED_PATH="ngx_pagespeed-${PAGESPEED_VERSION}-beta"

# nginx is disabled, use openresty
#"${NGINX_PATH};${NGINX_SHA256};http://nginx.org/download/${NGINX_PATH}.tar.gz"
# pagespeed is disabled, problems with static linking
# "${MOD_PAGESPEED_PATH};${MOD_PAGESPEED_SHA256};https://github.com/pagespeed/ngx_pagespeed/archive/v${MOD_PAGESPEED_VERSION}.tar.gz"
# "${MOD_PAGESPEED_PATH}/psol;${PAGESPEED_SHA256};https://dl.google.com/dl/page-speed/psol/${PAGESPEED_VERSION}.tar.gz"

APP_PARTS=(
    "${NGINX_OPENRESTY_PATH};${NGINX_OPENRESTY_SHA256};http://openresty.org/download/${NGINX_OPENRESTY_PATH}.tar.gz"
    "${PCRE_PATH};${PCRE_SHA256};ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/${PCRE_PATH}.tar.gz"
    "${OPENSSL_PATH};${OPENSSL_SHA256};https://www.openssl.org/source/${OPENSSL_PATH}.tar.gz"
    "${ZLIB_PATH};${ZLIB_SHA256};http://zlib.net/${ZLIB_PATH}.tar.gz"
)

for (( i=0 ; i < ${#APP_PARTS}; i++)) do
    set +u
    LINE="${APP_PARTS[i]}"
    set -u
    if [ -z "${LINE}" ]; then
        continue
    fi
    PREFIX="${LINE%;*}"
    URL="${LINE#*;*;}"
    SHA256SUM="${PREFIX#*;}"
    SOURCES="${PREFIX%;*}"
    ARCHIVE="${SOURCES}.tar.gz"
    SOURCES_DIR=$(echo "${SOURCES}" | sed 's|[^/]*$||')
    curl --insecure --max-filesize 160000000 --output "${ARCHIVE}" --location "${URL}"
    CHECKSUM=$(<"${ARCHIVE}" sha256sum --binary | cut --bytes=1-64)
    if [ "${CHECKSUM}" != "${SHA256SUM}" ]; then
        echo "checksum for ${ARCHIVE} did not match"
        exit
    fi
    tar --extract --gzip --directory="./${SOURCES_DIR}" --file "${ARCHIVE}"
    #rm "${ARCHIVE}"
done

BASE_DIR=$(pwd)
cd "${NGINX_OPENRESTY_PATH}"
./configure \
    --with-cc-opt="-static -static-libgcc" \
    --with-ld-opt="-static" \
    --with-cpu-opt=generic \
    --with-ipv6 \
    --with-poll_module \
    --with-select_module \
    --with-rtsig_module \
    --with-select_module \
    --with-poll_module \
    --with-http_ssl_module \
    --with-http_spdy_module \
    --with-http_realip_module \
    --with-http_addition_module \
    --with-http_sub_module \
    --with-http_dav_module \
    --with-http_flv_module \
    --with-http_mp4_module \
    --with-http_gunzip_module \
    --with-http_gzip_static_module \
    --with-http_auth_request_module \
    --with-http_random_index_module \
    --with-http_secure_link_module \
    --with-http_degradation_module \
    --with-http_stub_status_module \
    --with-mail \
    --with-mail_ssl_module \
    --with-zlib="${BASE_DIR}/${ZLIB_PATH}" \
    --with-pcre="${BASE_DIR}/${PCRE_PATH}" \
    --with-pcre-jit \
    --with-openssl="${BASE_DIR}/${OPENSSL_PATH}" \
    --with-openssl-opt='enable-ec_nistp_64_gcc_128' \
    --with-openssl-opt='no-comp' \
    --with-openssl-opt='no-deprecated' \
    --with-openssl-opt='no-heartbeats' \
    --with-openssl-opt='no-ssl2' \
    --user=nginx \
    --group=nginx \
    --prefix=/usr/local/nginx \
    --sbin-path=/usr/local/sbin/nginx \
    --conf-path=/etc/nginx/nginx.conf \
    --error-log-path=/var/log/nginx/nginx.err \
    --http-log-path=/var/log/nginx/access.log \
    --pid-path=/var/run/nginx/nginx.pid \
    --lock-path=/var/run/nginx/nginx.lock \
    --http-client-body-temp-path=/var/lib/nginx/temp.body \
    --http-proxy-temp-path=/var/lib/nginx/temp.proxy \
    --http-fastcgi-temp-path=/var/lib/nginx/temp.fastcgi \
    --http-scgi-temp-path=/var/lib/nginx/temp.scgi \
    --http-uwsgi-temp-path=/var/lib/nginx/temp.uwsgi

make -j8